Permissions, roles, and access controls finance teams can actually trust.

Roles

Roles that map to how finance teams really work.

Owner, admin, accountant, controller, viewer, and the Workplace Associate role for restricted portal users. Each role carries a permission set you can customize. Per-user entity grants layer on top; users see only the entities they're granted, in every report and search result.

• Owner, admin, accountant, controller, viewer roles.
• Workplace Associate role: restricted portal for PO submitters and vendor-mapped bill approvers.
• Per-user entity grants.
• Per-role permission customization.

Dual-Control Mode

Drafter and approver, separated.

Available on every plan. The user preparing a journal entry, bill, invoice, or settings change cannot be the same user who posts or applies it. Configurable approval chains and routing rules. Separation of duties enforced, not optional.

• Drafter and approver enforced as different users.
• Configurable approval chains.
• Separation of duties at the action level.
• Per-record audit trail with provenance.

SSO and 2FA

SAML SSO and two-factor authentication.

SAML SSO with domain verification and just-in-time user provisioning on Growth (1 connection) and Enterprise (unlimited connections + enforcement). Two-factor authentication is available on every plan and can be required for users in privileged roles.

• SAML SSO: 1 connection on Growth, unlimited + enforcement on Enterprise.
• Two-factor authentication on every plan.
• Domain verification and just-in-time provisioning.
• Session timeout configurable per workspace.

Audit trail

Every action recorded.

Immutable audit log of every user action against every record, capturing who changed what, what the prior value was, when the change was applied, and which IP and session. Exportable for audit support.